update certs

deployments/pvc-copy.yaml

@@ -1,44 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pvc-copy-deployment
-  labels:
-    app: pvc-copy
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: pvc-copy
-  template:
-    metadata:
-      labels:
-        app: pvc-copy
-    spec:
-      containers:
-      - name: pvc-copy
-        image: 192.168.1.149:8443/jwp-build:latest
-        volumeMounts:
-          - mountPath: /var/original-pvc
-            name: original-pvc
-          - mountPath: /var/new-pvc
-            name: new-pvc
-      volumes:
-      - name: original-pvc
-        persistentVolumeClaim:
-          claimName: kanboard-pvc
-      - name: new-pvc
-        persistentVolumeClaim:
-          claimName: kanboard-pvc-nfs
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: kanboard-pvc-nfs
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: nfs-client
-  resources:
-    requests:
-      storage: 2Gi

deployments/test-branch-pipeline.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: test-branch-pipeline-deployment
-  namespace: j7s-ci
-  labels:
-    app: test-branch-pipeline
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: test-branch-pipeline
-  template:
-    metadata:
-      labels:
-        app: test-branch-pipeline
-    spec:
-      volumes:
-         - name: ssh-volume
-           secret:
-              secretName: git-credentials
-      containers:
-      - name: branch-pipeline
-        image: 192.168.1.149:8443/j7s_branch_trigger:0.2
-        command: ["/bin/bash", "-c"]
-        volumeMounts:
-           - mountPath: /ssh-volume
-             name: ssh-volume
-        env:
-           - name: J7S_REPO
-             value: "ssh://git.jpace121.net:2222/tests/job-test"
-           - name: J7S_URL
-             value: http://el-test-pipeline-listener.j7s-ci.svc.cluster.local:8080
-        args:
-           - |
-            cp -r /ssh-volume ~/.ssh
-            chmod 700 ~/.ssh
-            chmod -R 400 ~/.ssh/*
-
-            j7s_branch_trigger

docs/cluster-v2-design.md

@@ -676,3 +676,11 @@ tar xpvzf /home/jimmy/db-backup.tar.gz
 sudo chown -R systemd-oom:systemd-oom *
 ```
 
+# Bugs
+After installation of fedora neeeded to run:
+
+```
+sudo lvextend /dev/mapper/fedora_fedora-root -l+100%FREE
+sudo xfs_growfs /dev/mapper/fedora_fedora-root
+```
+in the VM so the root directory wasn't limited to 15Gb.

docs/rotating_k3s_certs.md

@@ -0,0 +1,37 @@
+# Rotating k8s certs
+
+Problem: k3s client certs, including the admin cert expire after 1 year.
+
+To see cert:
+```
+cat ~/.kube/config | grep client-certificate-data | cut -f2 -d : | tr -d ' ' | base64 -d | openssl x509 -text -out -
+```
+
+```
+ssh jimmy@192.168.1.103
+sudo systemctl stop k3s
+sudo k3s certificate rotate
+sudo systemctl start k3s
+
+
+```
+
+```
+sudo cp /etc/rancher/k3s/k3s.yaml ~/j7s-cluster.yaml
+sudo chown jimmy:jimmy ~/j7s-cluster.yaml
+exit
+
+```
+
+```
+rm  ~/.kube/j7s-cluster.yaml
+scp jimmy@192.168.1.103:~/j7s-cluster.yaml /home/jimmy/.kube/.
+# Use text editor to fix IP in file.
+
+```
+
+```
+export KUBECONFIG=~/.kube/j7s-cluster.yaml
+kubectl get nodes
+```
+

docs/updating-ca.md

@@ -0,0 +1,47 @@
+# Updating CA
+
+## What is it?
+
+My client auth CA expired after 5 years and I needed to either reissue the CA or make a new one.
+
+The original one was built using cfssl.
+I decided that I would work with the CLI tools I've built in rust instead, and so instead of trying to
+renew the cert, I just built a new CA from scratch.
+
+Here is how.
+
+## Make the CA
+
+```
+cd ~/Develop/jpace121-certificate-authority
+j7s_mk_ca --org-name "jpace121.net CA" --valid-length 36500 -o ca
+```
+
+## Tell Nginx
+
+```
+scp ca/cert.pem admin@vpn.jpace121.net:/etc/nginx/client-truststores/jpace121-ca.pem
+```
+Then restart nginx.
+
+## Tell Keycloak
+
+```
+base64 -w 0 ca/cert.pem
+```
+
+Copy to keycloak-config.yaml.
+
+Deploy.
+
+```
+export KUBECONFIG=~/.kube/infra.yaml
+kubectl apply -f keycloak-config.yaml
+kubectl apply -f deployment.yaml
+kubectl rollout restart deployment keycloak-deployment -n keycloak
+```
+
+Watch the logs:
+```
+kubectl logs -n keycloak deployment/keycloak-deployment keycloak
+```

docs/updating-keycloak.md

@@ -0,0 +1,17 @@
+# Updating Keycloak
+
+If keycloak needs to be updated for harbor to work, you can't really pull the image
+from Harbor, so we directly import the image into the cluster.
+See the steps I followed below.
+
+```
+podman build -f images/Dockerfile -t harbor.internal.jpace121.net/k8s/jpace-keycloak:26.8.0 .
+podman save harbor.internal.jpace121.net/k8s/jpace-keycloak:26.8.0 -o keycloak.tar
+scp keycloak.tar jimmy@192.168.1.112:.
+ssh jimmy@192.168.1.112
+sudo k3s ctr images import keycloak.tar
+sudo k3s ctr images ls
+exit
+kubectl apply -f manifests/deployment.yaml
+kubectl rollout restart deployment keycloak-deployment -n keycloak
+```

docs/upgrading-k3s-notes.md

@@ -0,0 +1,53 @@
+# Notes on updating k3s and cilium
+
+Notes:
+1. Cilium need to be uninstalled with the cilium cli version it was installed with,
+   then reinstalled using the new cilium cli and the new installation instructions.
+2. K3S can be updated by calling the install script with the same options as before.
+
+
+Update k3s.
+Update cilium.
+
+Update k3s.
+
+j7s-cluster:
+```
+export INSTALL_K3S_EXEC="server --disable traefik --flannel-backend=none --disable-network-policy --cluster-cidr 10.46.0.0/16 --service-cidr 10.47.0.0/16 --cluster-dns 10.47.0.10 --selinux --resolv-conf /run/systemd/resolve/resolv.conf"
+curl -sfL https://get.k3s.io | sh -s -
+```
+
+infra-cluster:
+```
+export INSTALL_K3S_EXEC="server --disable traefik --flannel-backend=none --disable-network-policy --cluster-cidr 10.44.0.0/16 --service-cidr 10.45.0.0/16 --cluster-dns 10.45.0.10 --selinux"
+curl -sfL https://get.k3s.io | sh -s -
+```
+
+I don't know why I needed resolve-conf in one but not the other, but I did confirm it was not set in the infra-cluster systemd file...
+
+Update cilium:
+
+
+1. Move cilium binary to cilium-original
+
+For j7s-cluster:
+2. `export KUBECONFIG=~/.kube/j7s-cluster.yaml`
+3. `cilium-original uninstall`
+4. `cilium install --version 1.15.5 --set=ipam.operator.clusterPoolIPv4PodCIDRList="10.46.0.0/16"`
+5. `ssh jimmy@192.168.1.103`
+6. `sudo su`
+7. `iptables-save |  grep -v '\-A' | iptables-restore`
+8. `exit` `exit`
+
+
+For infra cluster:
+2. `export KUBECONFIG=~/.kube/infra.yaml`
+3. `cilium-original uninstall`
+4. `cilium install --version 1.15.5 --set=ipam.operator.clusterPoolIPv4PodCIDRList="10.44.0.0/16"`
+wait......
+5. `ssh jimmy@192.168.1.112`
+6. `sudo su`
+7. `iptables-save |  grep -v '\-A' | iptables-restore`
+8. `exit` `exit`
+
+I didn't wait where I put wait..... and had to rstart k3s...

images/Dockerfile_ansible-podman

@@ -1,4 +0,0 @@
-FROM quay.io/podman/stable:v4.2.1
-
-RUN dnf update && \
-    dnf install -y ansible git

images/Dockerfile_buildah

@@ -1,6 +0,0 @@
-FROM quay.io/buildah/upstream:latest
-
-# Add skopeo.
-RUN dnf install -y skopeo \
-    --exclude container-selinux \
-    --enablerepo=updates-testing

images/Dockerfile_curl

@@ -1,6 +0,0 @@
-FROM docker.io/debian:bullseye-slim
-
-RUN apt update -y && \
-    apt install -y \
-       curl \
-       jq

images/Dockerfile_gitssh

@@ -1,6 +0,0 @@
-FROM docker.io/debian:bullseye-slim
-
-RUN apt update -y && \
-    apt install -y \
-       git \
-       openssh-client

images/Dockerfile_j7s-image-build

@@ -1,9 +0,0 @@
-FROM quay.io/centos/centos:stream9
-RUN dnf install -y 'dnf-command(copr)' && \
-    dnf copr enable -y @osbuild/osbuild && \
-    dnf install -y osbuild osbuild-tools osbuild-ostree make sudo git
-RUN useradd -m -G wheel -s /bin/bash -u 1000 j7s && \
-    bash -c 'echo "%wheel  ALL=(ALL)       NOPASSWD: ALL" >> /etc/sudoers.d/container' && \
-    chmod 0440 /etc/sudoers.d/container
-USER j7s
-ENTRYPOINT ["bash"]

images/Dockerfile_vcs

@@ -1,10 +0,0 @@
-FROM docker.io/debian:bullseye-slim
-
-RUN apt update -y && \
-    apt install -y curl
-RUN curl -s https://packagecloud.io/install/repositories/dirk-thomas/vcstool/script.deb.sh | bash
-RUN apt update -y && \
-    apt install -y \
-       git \
-       openssh-client \
-       python3-vcstool

infra-cluster/gitea/manifests/config-map.yaml

@@ -11,6 +11,7 @@ metadata:
 data:
   GITEA____APP_NAME: "Forge"
   GITEA__server__DOMAIN: "git.jpace121.net"
+  GITEA__server__PUBLIC_URL_DETECTION: "never"
   GITEA__server__SSH_DOMAIN: "git.jpace121.net"
   GITEA__server__HTTP_PORT: "3000"
   GITEA__server__ROOT_URL: https://git.jpace121.net/
@@ -19,9 +20,9 @@ data:
   GITEA__server__LFS_START_SERVER: "true"
   GITEA__server__LFS_OFFLINE_MODE: "true"
   GITEA__server__LANDING_PAGE: "explore"
-  GITEA__database__PATH: "/data/gitea/gitea.db"
+  GITEA__database__PATH: "/data/gitea/gitea.db?_journal_mode=WAL&"
   GITEA__database__DB_TYPE: "sqlite3"
   GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION: "true"
   GITEA__openid__ENABLE_OPENID_SIGNIN: "false"
   GITEA__openid__ENABLE_OPENID_SIGNUP: "false"
-  GITEA__webhook__ALLOWED_HOST_LIST: "0x2A"
+  GITEA__security__ALLOWED_HOST_LIST: "0x2A"

infra-cluster/gitea/manifests/deployment.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: gitea-app
-        image: docker.io/gitea/gitea:1.19.0
+        image: docker.io/gitea/gitea:28.1
         ports:
         - containerPort: 3000
         - containerPort: 2222

infra-cluster/keycloak/images/Dockerfile

@@ -1,5 +1,4 @@
-FROM quay.io/keycloak/keycloak:20.0
+FROM quay.io/keycloak/keycloak:26.8
 WORKDIR /opt/keycloak
 RUN ./bin/kc.sh build \
-    --spi-x509cert-lookup-provider=nginx \
-    --features docker
+    --db postgres

infra-cluster/keycloak/manifests/deployment.yaml

@@ -8,6 +8,8 @@ metadata:
     app: keycloak
 spec:
   replicas: 1
+  strategy:
+     type: Recreate
   selector:
     matchLabels:
       app: keycloak
@@ -30,8 +32,12 @@ spec:
             secretKeyRef:
               name: keycloak-db-secret
               key: POSTGRES_PASSWORD
+        lifecycle:
+          preStop:
+            exec:
+              command: ["/usr/local/bin/pg_ctl stop -D /var/lib/postgresql/data -w -t 60 -m fast"]
       - name: keycloak
-        image: harbor.internal.jpace121.net/k8s/jpace-keycloak:20.0.0
+        image: harbor.internal.jpace121.net/k8s/jpace-keycloak:26.8.0
         env:
         - name: KC_LOG_LEVEL
           value: DEBUG
@@ -51,21 +57,29 @@ spec:
             secretKeyRef:
               name: keycloak-secret
               key: KC_DB_PASSWORD
+        - name: KC_SPI_X509CERT_LOOKUP_PROVIDER
+          value: "nginx"
+        - name: KC_SPI_X509CERT_LOOKUP__NGINX__SSL_CLIENT_CERT
+          value: "ssl-client-cert"
+        - name: KC_TRUSTSTORE_PATHS
+          value: "/opt/keycloak-config/jpace121-ca.pem"
+        - name: KC_HTTPS_CLIENT_AUTH
+          value: "request"
+        - name: KC_HOSTNAME
+          value: "https://auth.jpace121.net"
+        - name: KC_HOSTNAME_ADMIN
+          value: "https://auth.jpace121.net"
+        - name: KC_HOSTNAME_STRICT
+          value: "true"
+        - name: KC_PROXY_HEADERS
+          value: "xforwarded"
+        - name: KC_HTTP_ENABLED
+          value: "true"
         volumeMounts:
         - name: keycloak-config
           mountPath: /opt/keycloak-config/
         args:
         - start
-        - --hostname-url=https://auth.jpace121.net
-        - --hostname-strict-backchannel=true
-        - --hostname-admin-url=https://auth.jpace121.net
-        - --https-client-auth=request
-        - --spi-truststore-file-file=/opt/keycloak-config/truststore.jks
-        - --spi-truststore-file-password=password
-        - --spi-x509cert-lookup-nginx-ssl-client-cert=ssl-client-cert
-        - --spi-x509cert-lookup-provider=nginx
-        - --features docker
-        - --proxy=edge
       volumes:
       - name: db-storage
         persistentVolumeClaim:

infra-cluster/keycloak/manifests/keycloak-config.yaml

@@ -5,4 +5,4 @@ metadata:
   namespace: keycloak
 apiVersion: v1
 binaryData:
-  truststore.jks: MIIC4gIBAzCCAowGCSqGSIb3DQEHAaCCAn0EggJ5MIICdTCCAnEGCSqGSIb3DQEHBqCCAmIwggJeAgEAMIICVwYJKoZIhvcNAQcBMGYGCSqGSIb3DQEFDTBZMDgGCSqGSIb3DQEFDDArBBR06xf6EozPqDQ/xzGXp40CBqhk+AICJxACASAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEFizOH2LYOBzcHQsXzKXTJaAggHgiX6o5k8bo8w5RiwFngx7snUOMw9eYheq8YgkhuUhLgnx2uxYcw3ajFXYXuq/M6a5vXjQ7bLpeoidY9YdBl74UZjXEbLnTnWQQjjjoMIhBImmMe4ycxbRJ56EAJ4XDPhMwjf1dsGnCL1LX4KHNqVmHSGdkNJSB+PeU4Z6NrdO6sD9LPgaSTTq5b1czv3I8vH5aY/sT+8U4JR+P7xjNzobHzK2L+zcNTS1Hu29qYllQNsfks3gBsJn2Gmdw8NZXrRXCZZXQt7G4mqdPMuLrkd1pTjndYhsMHFMKA67WhNQe14UMlWPKpAPZ2nnS8x+AIVz2H5mQldVEXdeZDvujLYzRp5LyLwEYRHTIMEahGE0d9BIkijJ6kc5hGpF1IRlimVhZDowvX9sbtjHWgJdo5Gm3UEfSTQ9FSB7E8D11MbNZcaqbJcrK8GwKJHnSokCApaJ/Q2eat7YhhWJ/AkveXF0JYd8VPn4BTeOmukr+uZKzRPRoNyvG3orQYm78gJhmMqloHzI4f1VL68h+80VHtt2m+p99p3ZswyYh9dMhpdEue94VSCaMN9ZpEDB7RTYC6O0ZkVdd4uo6Kmu8MGhF8KQEBBCHKqL8ONVXFAcTzF1g5h8h644G29OmqXiro/Dy/gVME0wMTANBglghkgBZQMEAgEFAAQgGlefxTaHIgl4GJ5h3SQvPJSGNfFH2tCI9jtTh4U8KjEEFATo1+WMtc4hIa6Jt1vjX5YGS5mmAgInEA==
+  jpace121-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJsVENDQVRxZ0F3SUJBZ0lVWUc1c2tnbTJoQUtKWXlwa01ldFhZU0FMaEl3d0NnWUlLb1pJemowRUF3SXcKSnpFWU1CWUdBMVVFQ2d3UGFuQmhZMlV4TWpFdWJtVjBJRU5CTVFzd0NRWURWUVFEREFKRFFUQWdGdzB5TmpFdwpNVEF4TlRVeE5EQmFHQTh5TVRJMk1Ea3hOakUxTlRFME1Gb3dKekVZTUJZR0ExVUVDZ3dQYW5CaFkyVXhNakV1CmJtVjBJRU5CTVFzd0NRWURWUVFEREFKRFFUQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJBakUKdEpVSFZqbTl3eWRuUnhXbFd6U3lKTWRNMGVIbjNSNGZ2STFYbE1uU2VYOXlQN2VxU3pXRm4ydmZvbTJJaCtJUAozK2tRNlVkeCtVaE1UK2h2ZGJ5alFqQkFNQTRHQTFVZER3RUIvd1FFQXdJQmhqQWRCZ05WSFE0RUZnUVVDalI2CkJDQ0huSk5RRXFlK3FmOGZqQjI3bEZBd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBS0JnZ3Foa2pPUFFRREFnTkoKQURCR0FpRUE0VTJmVldIeUIyODdyT2gwMFo1L3lSYlBqNVpoWDg3U3JwSTVHN2k3b0NRQ0lRRFJ3WmlxYmRsRQptaGZiSC94Rm1VemY5TExzYVArbGpzU2VjcytYU1pES2dRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=

jobs/cache-check.yaml

@@ -1,21 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: cache-check
-spec:
-  template:
-    spec:
-      containers:
-      - name: cache-check
-        image: docker.io/debian:bullseye-slim
-        env:
-        - name: http_proxy
-          value: http://squid-service:3128
-        command: ["bash"]
-        args:
-          - "-c"
-          - >-
-            apt update -y &&
-            apt upgrade -y
-      restartPolicy: Never
-  backoffLimit: 1

jobs/nfs-test.yaml

@@ -1,33 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: test-claim
-spec:
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Mi
----
-kind: Pod
-apiVersion: v1
-metadata:
-  name: test-pod
-spec:
-  containers:
-  - name: test-pod
-    image: busybox:stable
-    command:
-      - "/bin/sh"
-    args:
-      - "-c"
-      - "touch /mnt/SUCCESS && exit 0 || exit 1"
-    volumeMounts:
-      - name: nfs-pvc
-        mountPath: "/mnt"
-  restartPolicy: "Never"
-  volumes:
-    - name: nfs-pvc
-      persistentVolumeClaim:
-        claimName: test-claim

jobs/test-trigger-check.yaml

@@ -1,21 +0,0 @@
-# Keeping this as an example, but the test pipeline was changed
-# at one point to show interoperability with PRs.
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: test-trigger-check
-  namespace: j7s-ci
-spec:
-  template:
-    spec:
-      containers:
-      - name: test-trigger-check
-        image: 192.168.1.149:8443/curl:latest
-        command: ["bash"]
-        args:
-          - "-c"
-          - >-
-            curl -X POST http://el-test-pipeline-listener.j7s-ci.svc.cluster.local:8080 -H 'Content-Type: application/json' -d '{}'
-      restartPolicy: Never
-  backoffLimit: 0

namespaces/harbor.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: harbor

namespaces/j7s-ci.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: j7s-ci

namespaces/nfs-subdir-external-provisioner.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: nfs-subdir-external-provisioner

pipelines/dev-contain-pipeline.yaml

@@ -1,55 +0,0 @@
-# A pipeline to build and deploy dev_contain packages.
-# Steps:
-#   Clone the dev_contain repo from gitea and checkout packaging branch.
-#   Call ansible play to build.
-#   Optionally, call play to deploy
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: dev-contain-pipeline
-  namespace: j7s-ci
-spec:
-  description: "Build and deploy dev_contain packages."
-  params:
-  - name: branch
-    type: string
-    description: The branch in the repo to call the build script in.
-  - name: deploy
-    type: string
-    description: "'true' if we should deploy the image using ansible."
-  workspaces:
-  - name: shared-data
-    description: Shared data.
-  - name: git-credentials
-    description: tekton git credentials
-  - name: deploy-credentials
-    description: tekton credentials to deployment server
-  tasks:
-  - name: fetch-repo
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git@git.jpace121.net:2222/packaging/dev_contain
-    - name: branch
-      value: $(params.branch)
-    taskRef:
-      name: j7s-git-clone
-  - name: build
-    runAfter: ["fetch-repo"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: deploy-credentials
-    params:
-    - name: deploy
-      value: $(params.deploy)
-    - name: ansible-file-path
-      value: .
-    taskRef:
-      name: j7s-ansible-build

pipelines/j7s-os-pipeline.yaml

@@ -1,79 +0,0 @@
-# A pipeline to build j7s-os images.
-# Steps:
-#   Clone the j7s-os repo from onedev.
-#   Call make <> in the repo.
-#   Build and push a new deployment container.
-#   Deploy the deployment container as a service.
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: j7s-os-pipeline
-  namespace: j7s-ci
-spec:
-  description: Build and deploy j7s-os images.
-  params:
-  - name: make-image-name
-    type: string
-    description: The name of image to make in the os repo.
-  - name: branch
-    type: string
-    default: main
-    description: branch of j7s-os image to build.
-  workspaces:
-  - name: shared-data
-    description: Shared data.
-  - name: git-credentials
-    description: My ssh credentials
-  tasks:
-  - name: fetch-repo
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git@git.jpace121.net:2222/public/j7s-os
-    - name: branch
-      value: $(params.branch)
-    taskRef:
-      name: j7s-git-clone
-  - name: image-build
-    runAfter: ["fetch-repo"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    params:
-    - name: image-name
-      value: $(params.make-image-name)
-    taskRef:
-      name: j7s-os-image-build
-  - name: build-deploy-image
-    runAfter: ["image-build"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    params:
-    - name: commit
-      value: $(params.make-image-name)
-    - name: image
-      value: j7s-os-deploy
-    - name: registry
-      value: 192.168.1.149:8443
-    - name: version
-      value: $(tasks.image-build.results.version-string)
-    taskRef:
-      name: j7s-os-buildah
-  - name: deploy-image
-    runAfter: ["build-deploy-image"]
-    workspaces:
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: image
-      value: 192.168.1.149:8443/j7s-os-deploy
-    - name: version
-      value: $(tasks.image-build.results.version-string)
-    taskRef:
-      name: j7s-os-k8s-deploy

pipelines/ostree-package-pipeline.yaml

@@ -1,48 +0,0 @@
-# A pipeline to build and deploy my fork of the debian packaging for ostree.
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: ostree-package-pipeline
-  namespace: j7s-ci
-spec:
-  description: "Package fork of ostree."
-  params:
-  - name: deploy
-    type: string
-    description: "'true' if we should deploy the image using ansible."
-  workspaces:
-  - name: shared-data
-    description: Shared data.
-  - name: git-credentials
-    description: tekton git credentials
-  - name: deploy-credentials
-    description: tekton credentials to deployment server
-  tasks:
-  - name: fetch-repo
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git.jpace121.net:2222/packaging/ostree
-    - name: branch
-      value: jamesp/latest
-    taskRef:
-      name: j7s-git-clone
-  - name: build
-    runAfter: ["fetch-repo"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: deploy-credentials
-    params:
-    - name: deploy
-      value: $(params.deploy)
-    - name: ansible-file-path
-      value: ./j7s-build-files
-    taskRef:
-      name: j7s-ansible-build

pipelines/simple-ros-pipeline.yaml

@@ -1,63 +0,0 @@
-# A pipeline to build the simple ros test containers.
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: simple-ros-pipeline
-  namespace: j7s-ci
-spec:
-  description: Build a image with a simple ros image.
-  workspaces:
-  - name: shared-data
-  - name: git-credentials
-  - name: cosign-credentials
-  tasks:
-  - name: ros-clone
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git.jpace121.net:2222/tests/j7s-simple-ws
-    - name: branch
-      value: master
-    - name: repos-file
-      value: source.repos
-    taskRef:
-      name: j7s-ros-clone
-  - name: image-build
-    runAfter: ["ros-clone"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    - name: cosign-credentials
-      workspace: cosign-credentials
-    params:
-    - name: registry
-      value: 192.168.1.149:8443
-    - name: name
-      value: simple-ros
-    - name: version
-      value: 0.1
-    - name: containerfile
-      value: ./docker/Dockerfile
-    taskRef:
-      name: j7s-buildah
-  results:
-  - name: image-ARTIFACT_OUTPUTS
-    type: object
-    value:
-       uri: $(tasks.image-build.results.image-ARTIFACT_OUTPUTS.uri)
-       digest: $(tasks.image-build.results.image-ARTIFACT_OUTPUTS.digest)
-  - name: commit-ARTIFACT_INPUTS
-    type: object
-    value:
-       uri: $(tasks.ros-clone.results.workspace-git-commit-ARTIFACT_OUTPUTS.uri)
-       digest: $(tasks.ros-clone.results.workspace-git-commit-ARTIFACT_OUTPUTS.digest)
-  - name: vcs-exact-file-ARTIFACT_INPUTS
-    type: object
-    value:
-       uri: $(tasks.ros-clone.results.vcs-exact-file-ARTIFACT_OUTPUTS.uri)
-       digest: $(tasks.ros-clone.results.vcs-exact-file-ARTIFACT_OUTPUTS.digest)

pipelines/test-pipeline.yaml

@@ -1,60 +0,0 @@
-# A pipeline to test the infrasture around calling pipelines.
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: test-pipeline
-  namespace: j7s-ci
-spec:
-  description: "A test pipeline."
-  workspaces:
-  - name: shared-data
-    description: Shared data.
-  - name: git-credentials
-    description: tekton git credentials
-  params:
-  - name: pr-id
-    description: ID number of the current PR.
-  tasks:
-  - name: fetch-repo
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git.jpace121.net:2222/tests/job-test
-    - name: branch
-      value: master
-    taskRef:
-      name: j7s-git-clone
-  - name: cat-readme
-    runAfter: ["fetch-repo"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    taskSpec:
-      workspaces:
-      - name: source
-      steps:
-      - image: docker.io/debian:bullseye-slim
-        script: |
-          set -x
-          cat $(workspaces.source.path)/README.md
-          exit 0
-  finally:
-    - name: notify-onedev
-      params:
-        - name: tekton-login-secret-name
-          value: onedev-api-key
-        - name: feedback-url
-          value: https://git.jpace121.net/
-        - name: pr-id
-          value: $(params.pr-id)
-        - name: run-name
-          value: $(context.pipelineRun.name)
-        - name: status
-          value: $(tasks.status)
-      taskRef:
-        name: j7s-onedev-pr-review

pipelines/test-report-pipeline.yaml

@@ -1,60 +0,0 @@
-# A pipeline to test the infrasture around calling pipelines.
----
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: test-report-pipeline
-  namespace: j7s-ci
-spec:
-  description: "A test pipeline."
-  workspaces:
-  - name: shared-data
-    description: Shared data.
-  - name: git-credentials
-    description: tekton git credentials
-  params:
-  - name: hash
-    default: HEAD
-  tasks:
-  - name: fetch-repo
-    workspaces:
-    - name: output
-      workspace: shared-data
-    - name: ssh-directory
-      workspace: git-credentials
-    params:
-    - name: url
-      value: ssh://git.jpace121.net:2222/tests/job-test
-    - name: hash
-      value: $(params.hash)
-    taskRef:
-      name: j7s-git-clone-hash
-  - name: cat-readme
-    runAfter: ["fetch-repo"]
-    workspaces:
-    - name: source
-      workspace: shared-data
-    taskSpec:
-      workspaces:
-      - name: source
-      steps:
-      - image: docker.io/debian:bullseye-slim
-        script: |
-          set -x
-          cat $(workspaces.source.path)/README.md
-          exit 0
-  finally:
-    - name: notify-onedev
-      params:
-        - name: tekton-login-secret-name
-          value: onedev-api-key
-        - name: feedback-url
-          value: https://git.jpace121.net/
-        - name: project-id
-          value: 9
-        - name: run-name
-          value: $(context.pipelineRun.name)
-        - name: status
-          value: $(tasks.status)
-      taskRef:
-        name: j7s-onedev-file-bug

runs/dev-contain-debian.yaml

@@ -1,28 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: dev-contain-debian-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: dev-contain-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  - name: deploy-credentials
-    secret:
-      secretName: deploy-credentials
-  params:
-  - name: branch
-    value: "packaging/debian"
-  - name: deploy
-    value: "true"

runs/dev-contain-rpm.yaml

@@ -1,28 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: dev-contain-rpm-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: dev-contain-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  - name: deploy-credentials
-    secret:
-      secretName: deploy-credentials
-  params:
-  - name: branch
-    value: "packaging/fedora"
-  - name: deploy
-    value: "true"

runs/j7s-os-test.yaml

@@ -1,25 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: j7s-os-test-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: j7s-os-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 3Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  params:
-  - name: make-image-name
-    value: cs9-qemu-minimal-ostree.x86_64.repo
-  - name: branch
-    value: main

runs/j7s-ros-clone.yaml

@@ -1,27 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: TaskRun
-metadata:
-  generateName: j7s-ros-clone-
-  namespace: j7s-ci
-spec:
-  taskRef:
-    name: j7s-ros-clone
-  workspaces:
-  - name: output
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 0.5Gi
-  - name: ssh-directory
-    secret:
-      secretName: git-credentials
-  params:
-  - name: url
-    value: "ssh://git.jpace121.net:2222/tests/j7s-simple-ws"
-  - name: branch
-    value: "master"
-  - name: repos-file
-    value: source.repos

runs/ostree-package.yaml

@@ -1,26 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: ostree-package-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: ostree-package-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  - name: deploy-credentials
-    secret:
-      secretName: deploy-credentials
-  params:
-  - name: deploy
-    value: "true"

runs/simple-ros-pipeline.yaml

@@ -1,23 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: simple-ros-pipeline-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: simple-ros-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials
-  - name: cosign-credentials
-    secret:
-      secretName: container-signing-secret

runs/test-report-pipeline.yaml

@@ -1,20 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  generateName: test-report-pipeline-
-  namespace: j7s-ci
-spec:
-  pipelineRef:
-    name: test-report-pipeline
-  workspaces:
-  - name: shared-data
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  - name: git-credentials
-    secret:
-      secretName: git-credentials

scripts/Dockerfile_flask

@@ -1,11 +0,0 @@
-FROM docker.io/debian:bullseye-slim
-
-RUN apt update -y && \
-    apt install -y python3-flask && \
-    mkdir /app
-
-COPY test.py /app/test.py
-
-WORKDIR /app
-ENV FLASK_APP=test
-CMD ["flask", "run", "--host", "0.0.0.0"]

scripts/bootstrap-flux.bash

@@ -1,5 +0,0 @@
-flux bootstrap git \
-  --url=ssh://git.jpace121.net:2222/cd/flux-infra \
-  --branch=master \
-  --author-name=flux \
-  --path=cluster

scripts/debug-pod.yaml

@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: jimmy-debug-pod
-  namespace: j7s-ci
-spec:
-  containers:
-  - image: docker.io/debian:bullseye-slim
-    name: jimmy-debug-pod
-    command: ["tail"]
-    args: ["-f", "/dev/null"]
-    volumeMounts:
-    - mountPath: /pvc
-      name: pvc-mount
-  volumes:
-  - name: pvc-mount
-    persistentVolumeClaim:
-      claimName: pvc-3244e44354

scripts/issue-body.json

@@ -1,10 +0,0 @@
-{
-"projectId" : 9 ,
-"title" : "Hi From Curl" ,
-"description" : "This was posted from curl." ,
-"confidential" : false ,
-"milestoneIds" : [ ] ,
-"fields" : {
-"Type" : "Build Failure"
-}
-}

scripts/registry/list-images.sh

@@ -1,2 +0,0 @@
-# See all images in cluster registry.
-curl -k -X GET -u $USERNAME:$PASSWORD https://192.168.1.128:8443/v2/_catalog

scripts/registry/list-tags.sh

@@ -1 +0,0 @@
-skopeo list-tags docker://192.168.1.149:8443/simple-ros

scripts/test.py

@@ -1,22 +0,0 @@
-from flask import Flask
-from flask import request
-import logging
-
-app = Flask(__name__)
-
-logger = logging.getLogger('j7s-app')
-logger.setLevel(logging.INFO)
-handler = logging.StreamHandler()
-logger.addHandler(handler)
-
-
-@app.route("/", defaults={"path": ""}, methods = ['POST', 'GET'])
-@app.route('/<path:path>', methods=['POST', 'GET'])
-def root(path):
-    logger.info("Path")
-    logger.info(path)
-    logger.info("Headers:")
-    logger.info(request.headers)
-    logger.info("Body:")
-    logger.info(request.json)
-    return "<p>Hello</p>"

scripts/test_onedev_issue.bash

@@ -1,4 +0,0 @@
-curl -u tekton:$TEKTON_API_KEY \
-     -d@issue-body.json \
-     -H "Content-Type: application/json" \
-     https://git.jpace121.net/~api/issues

serviceaccounts/tekton-bot.yaml

@@ -1,33 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: tekton-bot
-  namespace: j7s-ci
-secrets:
-  - name: git-credentials
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: tekton-bot-eventlistener-binding
-  namespace: j7s-ci
-subjects:
-- kind: ServiceAccount
-  name: tekton-bot
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tekton-triggers-eventlistener-roles
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: tekton-bot-eventlistener-clusterbinding
-subjects:
-- kind: ServiceAccount
-  name: tekton-bot
-  namespace: j7s-ci
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tekton-triggers-eventlistener-clusterroles

triggers/test-trigger.yaml

@@ -1,59 +0,0 @@
----
-apiVersion: triggers.tekton.dev/v1beta1
-kind: EventListener
-metadata:
-  name: test-pipeline-listener
-  namespace: j7s-ci
-spec:
-  serviceAccountName: tekton-bot
-  triggers:
-    - name: test-pipeline-trigger
-      bindings:
-        - ref: test-pipeline-binding
-      template:
-        ref: test-pipeline-template
-  resources:
-    kubernetesResource:
-      serviceType: ClusterIP
----
-apiVersion: triggers.tekton.dev/v1beta1
-kind: TriggerBinding
-metadata:
-  name: test-pipeline-binding
-  namespace: j7s-ci
-spec:
-  params:
-    - name: hash
-      value: $(body.hash)
----
-apiVersion: triggers.tekton.dev/v1beta1
-kind: TriggerTemplate
-metadata:
-  name: test-pipeline-template
-  namespace: j7s-ci
-spec:
-  params:
-  - name: hash
-  resourcetemplates:
-  - apiVersion: tekton.dev/v1beta1
-    kind: PipelineRun
-    metadata:
-      generateName: test-pipeline-
-    spec:
-      pipelineRef:
-        name: test-report-pipeline
-      params:
-      - name: hash
-        value: "$(tt.params.hash)"
-      workspaces:
-      - name: shared-data
-        volumeClaimTemplate:
-          spec:
-            accessModes:
-            - ReadWriteOnce
-            resources:
-              requests:
-                  storage: 1Gi
-      - name: git-credentials
-        secret:
-          secretName: git-credentials